Google’s Chrome untouched at Pwn2Own hack match

Google Inc.’s US$20,000 was as safe at Pwn2Own Wednesday as if it had been in the bank.

The search giant had promised to pay $20,000 to the first researcher who broke into Chrome on the hacking contest’s opening day.

But no one took up Google’s offer.

“The first contestant was a no-show,” said Aaron Portnoy, manager of HP TippingPoint’s security research team, and Pwn2Own’s organizer. “And the other team wanted to work on their BlackBerry vulnerability. So it doesn’t look like anyone will try Chrome.”

Only two entries had pre-registered for Chrome: Moatz Khader and one or more researchers going as “Team Anon.” (Researchers may remain anonymous if they wish.) Based on a random drawing several weeks ago, Khader was to get first shot, with Team Anon second.

Team Anon is also slated to tackle RIM’s BlackBerry OS on Thursday.

Late Wednesday, TippingPoint provided a tentative schedule for today’s Pwn2Own; that schedule doesn’t show any planned Chrome exploit.

Even if someone unexpectedly stepped up to take a crack at Chrome and exploited the browser, Google would be on the hook for just $10,000. As part of the deal it struck with TippingPoint, the two will split the $20,000 payment for a successful hack on the second or third days of the contest.

If Chrome comes out unscathed, as it now appears it will, the browser will have survived three consecutive Pwn2Owns, a record.

On Wednesday, researchers successfully exploited Safari and Internet Explorer . A team from French security company Vupen took down Safari 5 running on a MacBook Air notebook in five seconds, and independent researcher Stephen Fewer used a trio of vulnerabilities to hack IE8 on Windows 7.

Portnoy was impressed with Fewer’s work. “The most impressive so far,” said Portnoy. “He used three vulnerabilities to [not only] bypass ASLR and DEP, but also escape Protected Mode. That’s something we’ve not seen at Pwn2Own before.”

ASLR, for address space layout randomization, and DEP, or data execution prevention, are a pair of technologies baked into Windows that are designed to make it more difficult for exploits to reliably execute. Protected Mode is IE’s “sandbox,” which isolates the browser — and thus any attack code that manages to infiltrate it — from escaping to do damage on the system as a whole.

Pwn2Own continues today and Friday, when Mozilla’s Firefox and four smartphones running Apple’s iOS, Google’s Android, Microsoft’s Windows 7 Phone and RIM’s BlackBerry OS will be in researchers’ crosshairs.

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

Featured Articles

Empowering the hybrid workforce: how technology can build a better employee experience

Across the country, employees from organizations of all sizes expect flexibility...

What’s behind the best customer experience: How to make it real for your business

The best customer experience – the kind that builds businesses and...

Overcoming the obstacles to optimized operations

Network-driven optimization is a top priority for many Canadian business leaders...

Thriving amid Canada’s tech talent shortage

With today’s tight labour market, rising customer demands, fast-evolving cyber threats...

Staying protected and compliant in an evolving IT landscape

Canadian businesses have changed remarkably and quickly over the last few...

Related Tech News

Tech Jobs

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

Tech Companies Hiring Right Now